The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5177 advisory.

  - LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP     directory. The profile editor tool has an edit profile functionality, the parameters on this page are not     properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in     the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor     tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an     user can enter relative paths like     ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like     burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that     path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The     issue is fixed in version 7.9.1. (CVE-2022-24851)

  - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)     stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from     arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution     if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in     version 8.0. (CVE-2022-31084)

  - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)     stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and     password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by     configuration. This issue has been fixed in version 8.0. Users unable to upgrade should install the PHP     OpenSSL extension and make sure session encryption is enabled in LAM main configuration. (CVE-2022-31085)

  - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)     stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP     scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the     /config/templates/pdf/ directory is accessible for remote users. This is not a default configuration of     LAM. This issue has been fixed in version 8.0. There are no known workarounds for this issue.
    (CVE-2022-31086)

  - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)     stored in an LDAP directory. In versions prior to 8.0 the tmp directory, which is accessible by /lam/tmp/,     allows interpretation of .php (and .php5/.php4/.phpt/etc) files. An attacker capable of writing files     under www-data privileges can write a web-shell into this directory, and gain a Code Execution on the     host. This issue has been fixed in version 8.0. Users unable to upgrade should disallow executing PHP     scripts in (/var/lib/ldap-account-manager/)tmp directory. (CVE-2022-31087)

  - LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings)     stored in an LDAP directory. In versions prior to 8.0 the user name field at login could be used to     enumerate LDAP data. This is only the case for LDAP search configuration. This issue has been fixed in     version 8.0. (CVE-2022-31088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5177-1 : ldap-account-manager - security update

high Nessus Plugin ID 162762

Version 1.5

Version 1.4

Version 1.4

Version 1.5 Oct 19, 2023, 5:33 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310191733
Version 1.4 Mar 23, 2023, 8:46 PM Plugin requirements Plugin Feed: 202303232046
Version 1.4 Oct 19, 2023, 2:51 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202310191451